Cloud Automation GCLD Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   A security engineer needs to automate the enforcement of a new compliance policy across 500 AWS accounts in an organization. The policy requires that any S3 bucket with public read access is automatically made private within 15 minutes of detection. The solution must be centralized, auditable, and not require deploying agents to each account. Which approach best meets these requirements?

   • AUse AWS Organizations with AWS Config aggregator and a central remediation account that runs Systems Manager Automation documents via EventBridge.
   • BDeploy a Lambda function in each account that runs every 5 minutes and checks S3 bucket policies.
   • CUse AWS Trusted Advisor to check for public buckets and email the account owner.
   • DUse AWS CloudTrail to detect PutBucketPolicy events and send an SNS notification to a central security team for manual remediation.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the primary purpose of cloud automation?

   • ATo increase the need for human oversight in every cloud operation
   • BTo eliminate the need for any monitoring or logging in the cloud
   • CTo reduce manual effort and improve consistency in managing cloud resources and workflows
   • DTo manually manage cloud resources through the console
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A company uses a CI/CD pipeline to deploy applications to AWS. The security team wants to automatically prevent deployments that do not meet compliance policies, such as having encryption enabled and proper tagging. What is the most effective way to enforce these policies?

   • ARun a manual compliance review by the security team before each deployment.
   • BUse AWS Config to detect non-compliant resources after deployment and alert the team.
   • CCreate a checklist in the deployment documentation and require developers to confirm compliance.
   • DIntegrate a policy-as-code tool like Open Policy Agent (OPA) into the pipeline to evaluate the infrastructure templates before deployment.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the role of continuous deployment (CD) in a CI/CD pipeline?

   • ATo manually approve and deploy every code change
   • BTo only build code without testing it
   • CTo automatically deploy code changes to production after passing tests
   • DTo roll back all changes automatically if any error occurs
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company uses Azure DevOps to manage their CI/CD pipelines. They want to automate the deployment of infrastructure using Azure Resource Manager (ARM) templates. They need to ensure that deployments are repeatable and that the same template can be used for different environments (dev, test, prod) with different parameter values. Which approach should they use?

   • ACreate a separate ARM template for each environment.
   • BUse ARM template parameters and separate parameter files for each environment.
   • CHardcode environment-specific values in the template.
   • DUse Azure Policy to override template values.
   Reveal Solution Discussion Select an answer first